@webship.co/workspace 1.0.0-beta1 → 1.0.0-rc1

package/core/workspace-app/tests/unit/auth-google.test.js

@@ -0,0 +1,180 @@
+/**
+ * Sign in with Google for the dashboard: who gets in, what the cookie proves, and what a request meets
+ * when it has none. Google is a local stand-in; the module's own handler is wrapped in a bare http server,
+ * so what is tested is the gate, not the rest of the dashboard.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const http = require('http');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const CONFIG = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-auth-'));
+process.env.WORKSPACE_CONFIG = CONFIG;
+process.env.WORKSPACE_AUTH_DIR = path.join(CONFIG, '.auth');
+const HUB = 'hub.example.test';
+
+// The OAuth client lives with the Google Drive plugin, in its own settings file.
+fs.writeFileSync(path.join(CONFIG, 'plugin.google-drive-sync.settings.yml'), 'client_id: cid.apps.googleusercontent.com\nclient_secret: csecret1234\n');
+const setSettings = (extra = '') => fs.writeFileSync(path.join(CONFIG, 'settings.yml'), [`hub_domain: ${HUB}`, extra].join('\n'));
+const signinOn = (more = '') => setSettings(`auth:\n  google:\n    enabled: true\n    allowed_domains:\n      - example.com\n${more}`);
+
+const auth = require('../../auth-google');
+
+const b64 = (o) => Buffer.from(JSON.stringify(o)).toString('base64url');
+const idToken = (claims) => `h.${b64(claims)}.s`;
+
+function appServer() {
+  const server = http.createServer(async (req, res) => {
+    const { pathname } = new URL(req.url, 'http://x');
+    if (await auth.gate(req, res, pathname)) return;
+    res.writeHead(200, { 'Content-Type': 'text/plain' });
+    res.end('the dashboard');
+  });
+  return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server)));
+}
+const get = (server, p, headers = {}) => new Promise((resolve, reject) => {
+  http.get({ host: '127.0.0.1', port: server.address().port, path: p, headers: { host: `dev.${HUB}`, ...headers } }, (res) => {
+    let body = ''; res.on('data', (d) => { body += d; }); res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
+  }).on('error', reject);
+});
+
+test('with sign-in off the dashboard is open, as it always was', async () => {
+  setSettings();
+  const s = await appServer();
+  try {
+    assert.strictEqual((await get(s, '/')).body, 'the dashboard');
+    assert.deepStrictEqual(JSON.parse((await get(s, '/auth/me')).body), { enabled: false });
+  } finally { s.close(); }
+});
+
+test('with sign-in on, a page goes to sign in, an htmx call is told to, and an action gets 401', async () => {
+  signinOn();
+  const s = await appServer();
+  try {
+    const page = await get(s, '/dev');
+    assert.strictEqual(page.status, 302);
+    assert.match(page.headers.location, new RegExp(`^https://${HUB}/auth/signin\\?next=`));
+    assert.match(decodeURIComponent(page.headers.location), new RegExp(`next=https://dev\\.${HUB}/dev$`));
+    const htmx = await get(s, '/fragments/anything', { 'hx-request': 'true' });
+    assert.strictEqual(htmx.status, 401);
+    assert.match(htmx.headers['hx-redirect'], /\/auth\/signin/);
+    const post = await new Promise((resolve) => { const r = http.request({ host: '127.0.0.1', port: s.address().port, path: '/actions/build', method: 'POST', headers: { host: `dev.${HUB}` } }, (res) => { res.resume(); resolve(res.statusCode); }); r.end(); });
+    assert.strictEqual(post, 401);
+  } finally { s.close(); }
+});
+
+test('it fails closed: on with no client, or with nobody allowed, it lets nobody in and says why', async () => {
+  // No client: the Drive plugin's file is gone for this case, and put back after.
+  const pluginFile = path.join(CONFIG, 'plugin.google-drive-sync.settings.yml');
+  const client = fs.readFileSync(pluginFile, 'utf8');
+  fs.unlinkSync(pluginFile);
+  fs.writeFileSync(path.join(CONFIG, 'settings.yml'), `hub_domain: ${HUB}\nauth:\n  google:\n    enabled: true\n    allowed_domains:\n      - example.com\n`);
+  let s = await appServer();
+  try {
+    const r = await get(s, '/dev');
+    assert.strictEqual(r.status, 503);
+    assert.match(r.body, /letting nobody in/);
+  } finally { s.close(); fs.writeFileSync(pluginFile, client); }
+  setSettings('auth:\n  google:\n    enabled: true');
+  s = await appServer();
+  try { assert.strictEqual((await get(s, '/dev')).status, 503); } finally { s.close(); }
+});
+
+test('the cookie proves who you are, and a forged, edited or expired one proves nothing', () => {
+  signinOn();
+  const good = auth.makeSession({ email: 'a@example.com', name: 'A' }, 1);
+  const req = (c) => ({ headers: { cookie: `x=1; ws-session=${c}` } });
+  assert.deepStrictEqual(auth.sessionOf(req(good)), { email: 'a@example.com', name: 'A' });
+  const [body, mac] = good.split('.');
+  const edited = `${b64({ ...JSON.parse(Buffer.from(body, 'base64url')), e: 'boss@example.com' })}.${mac}`;
+  assert.strictEqual(auth.sessionOf(req(edited)), null, 'editing the email breaks the signature');
+  assert.strictEqual(auth.sessionOf(req(`${body}.${'A'.repeat(mac.length)}`)), null);
+  assert.strictEqual(auth.sessionOf(req(auth.makeSession({ email: 'a@example.com' }, -1))), null, 'expired');
+  assert.strictEqual(auth.sessionOf({ headers: {} }), null);
+});
+
+test('who is allowed: a verified address on an allowed Workspace domain, or one named address', () => {
+  const cfg = { domains: ['example.com'], emails: ['guest@example.org'] };
+  const ok = (c) => auth.allowed(c, cfg).ok;
+  assert.ok(ok({ email: 'a@example.com', email_verified: true, hd: 'example.com' }));
+  assert.ok(ok({ email: 'A@Example.com', email_verified: true, hd: 'example.com' }), 'case does not matter');
+  assert.ok(!ok({ email: 'a@example.com', email_verified: false, hd: 'example.com' }), 'unverified');
+  assert.ok(!ok({ email: 'a@example.com', email_verified: true }), 'a plain gmail-style account cannot claim the domain: no hd');
+  assert.ok(!ok({ email: 'a@evil.com', email_verified: true, hd: 'evil.com' }));
+  assert.ok(!ok({ email: 'a@example.com.evil.com', email_verified: true, hd: 'example.com.evil.com' }), 'a suffix is not the domain');
+  assert.ok(ok({ email: 'guest@example.org', email_verified: true }), 'a named address needs no domain');
+  assert.ok(!auth.allowed({ email: 'a@example.com', email_verified: true, hd: 'example.com' }, { domains: [], emails: [] }).ok, 'nothing allowed, nobody in');
+});
+
+test('a full sign-in, against a stand-in for Google, ends in a cookie that opens the dashboard', async () => {
+  signinOn();
+  let seen;
+  const google = http.createServer((req, res) => {
+    let b = ''; req.on('data', (d) => { b += d; });
+    req.on('end', () => { seen = new URLSearchParams(b); res.writeHead(200, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ id_token: idToken(google.claims) })); });
+  });
+  await new Promise((r) => google.listen(0, '127.0.0.1', r));
+  process.env.GOOGLE_TOKEN_URL = `http://127.0.0.1:${google.address().port}/token`;
+  const s = await appServer();
+  try {
+    const start = await get(s, `/auth/google/login?next=${encodeURIComponent(`https://dev.${HUB}/dev`)}`);
+    assert.strictEqual(start.status, 302);
+    const to = new URL(start.headers.location);
+    assert.strictEqual(to.origin + to.pathname, 'https://accounts.google.com/o/oauth2/v2/auth');
+    assert.strictEqual(to.searchParams.get('scope'), 'openid email profile');
+    assert.strictEqual(to.searchParams.get('redirect_uri'), `https://${HUB}/auth/google/callback`);
+    assert.strictEqual(to.searchParams.get('hd'), 'example.com');
+    const state = to.searchParams.get('state');
+    const claims = { iss: 'https://accounts.google.com', aud: 'cid.apps.googleusercontent.com', exp: Math.floor(Date.now() / 1000) + 600, nonce: to.searchParams.get('nonce'), email: 'member@example.com', email_verified: true, hd: 'example.com', name: 'Team Member' };
+
+    google.claims = { ...claims, nonce: 'someone-elses' };
+    const replayed = await get(s, `/auth/google/callback?code=c&state=${state}`);
+    assert.strictEqual(replayed.status, 403, 'a token for a different request is refused');
+    assert.match(replayed.body, /does not match/);
+
+    const again = await get(s, `/auth/google/login?next=${encodeURIComponent(`https://dev.${HUB}/dev`)}`);
+    const t2 = new URL(again.headers.location);
+    google.claims = { ...claims, nonce: t2.searchParams.get('nonce') };
+    const done = await get(s, `/auth/google/callback?code=thecode&state=${t2.searchParams.get('state')}`);
+    assert.strictEqual(done.status, 302, done.body);
+    assert.strictEqual(done.headers.location, `https://dev.${HUB}/dev`);
+    assert.strictEqual(seen.get('code'), 'thecode');
+    const cookie = done.headers['set-cookie'][0];
+    assert.match(cookie, new RegExp(`Domain=\\.${HUB.replace(/\./g, '\\.')}; HttpOnly; Secure; SameSite=Lax`));
+    const inside = await get(s, '/dev', { cookie: cookie.split(';')[0] });
+    assert.strictEqual(inside.body, 'the dashboard');
+    assert.deepStrictEqual(JSON.parse((await get(s, '/auth/me', { cookie: cookie.split(';')[0] })).body), { enabled: true, email: 'member@example.com', name: 'Team Member' });
+
+    const out = await get(s, '/auth/signout', { cookie: cookie.split(';')[0] });
+    assert.match(out.headers['set-cookie'][0], /Max-Age=0/);
+
+    const third = await get(s, '/auth/google/login');
+    const t3 = new URL(third.headers.location);
+    google.claims = { ...claims, nonce: t3.searchParams.get('nonce'), email: 'x@gmail.com', hd: undefined };
+    const denied = await get(s, `/auth/google/callback?code=c&state=${t3.searchParams.get('state')}`);
+    assert.strictEqual(denied.status, 403);
+    assert.ok(!denied.headers['set-cookie'], 'no cookie for a refused account');
+    assert.match(denied.body, /not allowed/);
+  } finally { s.close(); google.close(); delete process.env.GOOGLE_TOKEN_URL; }
+});
+
+test('after sign-in only the hub or a workspace page is a place to go back to', () => {
+  signinOn();
+  assert.strictEqual(auth.safeNext(`https://dev.${HUB}/dev`), `https://dev.${HUB}/dev`);
+  assert.strictEqual(auth.safeNext('https://evil.example/'), `https://${HUB}/`);
+  assert.strictEqual(auth.safeNext(`https://${HUB}.evil.example/`), `https://${HUB}/`);
+  assert.strictEqual(auth.safeNext(`http://dev.${HUB}/`), `https://${HUB}/`, 'not downgraded to http');
+  assert.strictEqual(auth.safeNext('//evil.example/x'), `https://${HUB}/`);
+  assert.strictEqual(auth.safeNext('/settings'), `https://${HUB}/settings`);
+});
+
+test('a terminal socket needs the session too', () => {
+  signinOn();
+  assert.strictEqual(auth.upgradeAllowed({ headers: {} }), false);
+  assert.strictEqual(auth.upgradeAllowed({ headers: { cookie: `ws-session=${auth.makeSession({ email: 'a@example.com' }, 1)}` } }), true);
+  setSettings();
+  assert.strictEqual(auth.upgradeAllowed({ headers: {} }), true, 'and open when sign-in is off');
+});

package/core/workspace-app/tests/unit/autostart-watch.test.js

@@ -0,0 +1,76 @@
+/**
+ * The Docker-restart watcher.
+ *
+ * The boot service starts the dashboard once; a Docker restart afterwards stopped every container and nothing
+ * started them again (workspace.ddev.site answered nothing until somebody noticed). The watcher remembers
+ * when Docker last started and runs the start script once when that changes. It must never start anything
+ * only because the dashboard is down: a dashboard stopped on purpose stays stopped.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const SCRIPTS = path.join(__dirname, '../../../scripts');
+const WATCH = path.join(SCRIPTS, 'autostart-watch.sh');
+
+function sandbox() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-watch-'));
+  const ran = path.join(dir, 'ran');
+  const look = (stamp) => spawnSync('bash', [WATCH], {
+    encoding: 'utf8',
+    env: { PATH: process.env.PATH, HOME: dir, AUTOSTART_WATCH_STATE: path.join(dir, 'stamp'),
+      AUTOSTART_WATCH_RUN: `echo RAN >> '${ran}'`, AUTOSTART_WATCH_DOCKER_STAMP: stamp },
+  });
+  const runs = () => (fs.existsSync(ran) ? fs.readFileSync(ran, 'utf8').trim().split('\n').length : 0);
+  return { look, runs, dir };
+}
+
+test('the first look only remembers; a restart runs the start script once', () => {
+  const s = sandbox();
+  s.look('Wed 2026-10-14 10:51:26 +03');
+  assert.strictEqual(s.runs(), 0, 'nothing is started just because it looked');
+  s.look('Wed 2026-10-14 10:51:26 +03');
+  assert.strictEqual(s.runs(), 0, 'the same Docker start is not a restart');
+  const out = s.look('Wed 2026-10-14 14:02:00 +03');
+  assert.strictEqual(s.runs(), 1);
+  assert.match(out.stdout, /Docker restarted \(Wed 2026-10-14 10:51:26 \+03 -> Wed 2026-10-14 14:02:00 \+03\)/);
+  s.look('Wed 2026-10-14 14:02:00 +03');
+  assert.strictEqual(s.runs(), 1, 'and only once for that restart');
+  s.look('Wed 2026-10-14 16:30:00 +03');
+  assert.strictEqual(s.runs(), 2, 'a later restart is a new one');
+  fs.rmSync(s.dir, { recursive: true, force: true });
+});
+
+test('Docker not answering does nothing', () => {
+  const s = sandbox();
+  s.look('Wed 10:51');
+  s.look('');
+  assert.strictEqual(s.runs(), 0);
+  assert.strictEqual(fs.readFileSync(path.join(s.dir, 'stamp'), 'utf8').trim(), 'Wed 10:51', 'and forgets nothing');
+  fs.rmSync(s.dir, { recursive: true, force: true });
+});
+
+test('a start that fails is not retried every two minutes', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-watch-'));
+  const ran = path.join(dir, 'ran');
+  const look = (stamp) => spawnSync('bash', [WATCH], { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: dir,
+    AUTOSTART_WATCH_STATE: path.join(dir, 'stamp'), AUTOSTART_WATCH_RUN: `echo RAN >> '${ran}'; exit 1`, AUTOSTART_WATCH_DOCKER_STAMP: stamp } });
+  look('A');
+  look('B');
+  look('B');
+  look('B');
+  assert.strictEqual(fs.readFileSync(ran, 'utf8').trim().split('\n').length, 1, 'one attempt for that restart, however it ended');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('enable installs the timer and disable removes it', () => {
+  const fn = fs.readFileSync(path.join(SCRIPTS, 'functions/fun-autostart.sh'), 'utf8');
+  assert.match(fn, /function autostart_write_watch\(\)/);
+  assert.match(fn, /OnUnitActiveSec=2min/);
+  assert.match(fn, /systemctl --user enable --now "\$\{AUTOSTART_WATCH_NAME\}\.timer"/);
+  assert.match(fn, /systemctl --user disable --now "\$\{AUTOSTART_WATCH_NAME\}\.timer"/);
+});

package/core/workspace-app/tests/unit/browsers.test.js

@@ -0,0 +1,76 @@
+/**
+ * The Screens page lists the automation browsers a session leaves running. The
+ * listing itself needs a live browser; the PARSING does not, so the real
+ * command lines are pinned here — including the ones that must NOT be listed.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+
+const { parseBrowserLine } = require('../../screens');
+
+// A real Playwright MCP browser, as `ps -eo pid,etime,args` prints it.
+const MCP_CHROME = '1359368 12:03 /opt/google/chrome/chrome --disable-field-trial-config --no-first-run '
+  + '--user-data-dir=/home/rajab/.cache/ms-playwright-mcp/mcp-chrome-fe954a1 --remote-debugging-pipe about:blank';
+
+test('a Playwright MCP browser is recognised, with its profile', () => {
+  const b = parseBrowserLine(MCP_CHROME);
+  assert.ok(b, 'the line is a browser');
+  assert.strictEqual(b.pid, '1359368');
+  assert.strictEqual(b.profile, 'mcp-chrome-fe954a1');
+  assert.strictEqual(b.pipe, true, 'driven over a pipe');
+  assert.strictEqual(b.port, '', 'so there is no DevTools port to offer');
+  assert.strictEqual(b.headless, false);
+});
+
+test('a headless browser with a debugging port reports both', () => {
+  const b = parseBrowserLine('4242 00:31 /usr/lib/chromium/chromium --headless=new --no-sandbox '
+    + '--remote-debugging-port=9222 --user-data-dir=/tmp/pw-profile about:blank');
+  assert.ok(b);
+  assert.strictEqual(b.headless, true);
+  assert.strictEqual(b.port, '9222');
+  assert.strictEqual(b.profile, 'pw-profile');
+});
+
+test('renderer processes and ordinary browsers are not listed', () => {
+  // A renderer child: same binary, but it is not the browser.
+  assert.strictEqual(parseBrowserLine('1359377 12:03 /opt/google/chrome/chrome --type=zygote '
+    + '--user-data-dir=/home/rajab/.cache/ms-playwright-mcp/mcp-chrome-fe954a1'), null);
+  // The docs tooling's screenshot chromium: no automation flags, no profile.
+  assert.strictEqual(parseBrowserLine('68819 11:00 /usr/lib/chromium/chromium --show-component-extension-options'), null);
+  // Not a browser at all.
+  assert.strictEqual(parseBrowserLine('999 00:02 /usr/bin/node server.js'), null);
+  assert.strictEqual(parseBrowserLine('not a ps line'), null);
+});
+
+// After the sessions moved to the machine the dashboard shares its pid
+// namespace, so `ps` in here also lists the suite's browser inside a project's
+// web container, and the wrappers that merely mention chromium on their command
+// line. Neither is a browser on the desktop.
+test('the suite runner and its docker wrapper are not browsers', () => {
+  const lines = [
+    ' 841992       02:26 ddev exec PLAYWRIGHT_BROWSERS_PATH=/mnt/ddev-global-cache/ms-playwright BROWSER=chromium yarn run test:chromium',
+    ' 842061       02:26 /home/rajab/.ddev/bin/docker-compose -f /home/rajab/workspace/dev/v11x00b1/.ddev/.ddev-docker-compose-full.yaml exec web bash -c set -eu && ( PLAYWRIGHT_BROWSERS_PATH=/mnt/ddev-global-cache/ms-playwright BROWSER=chromium yarn run test:chromium)',
+    ' 842084       02:26 bash -c set -eu && ( PLAYWRIGHT_BROWSERS_PATH=/mnt/ddev-global-cache/ms-playwright BROWSER=chromium yarn run test:chromium)',
+  ];
+  for (const line of lines) {
+    assert.equal(parseBrowserLine(line), null, `not a browser: ${line.slice(0, 60)}`);
+  }
+});
+
+test('a headless shell is headless even without the flag', () => {
+  const b = parseBrowserLine(' 855556       00:04 /mnt/ddev-global-cache/ms-playwright/chromium_headless_shell-1223/chrome-headless-shell-linux64/chrome-headless-shell --remote-debugging-pipe --user-data-dir=/tmp/playwright_chromiumdev_profile-ZAMCsO');
+  assert.ok(b, 'the headless shell is a browser');
+  assert.equal(b.headless, true, 'the binary alone says it has no window');
+  assert.equal(b.pipe, true);
+});
+
+// A browser inside a project's web container: this process cannot read its
+// cmdline, so `ps` prints the executable path alone — cut, here, at the
+// directory that names the build.
+test('a browser in another container is still listed', () => {
+  const b = parseBrowserLine(' 860652       00:21 /mnt/ddev-global-cache/ms-playwright/chromium_headless_shell');
+  assert.ok(b, 'the path alone is enough to know what it is');
+  assert.equal(b.headless, true, 'the build directory says headless shell');
+  assert.equal(b.profile, 'test browser');
+});

package/core/workspace-app/tests/unit/build-distribution.test.js

@@ -0,0 +1,125 @@
+/**
+ * What build_distribution runs, in what order, for a release line that needs more than one composer step.
+ *
+ * ddev and the helpers around it are stubbed, so the test reads the calls rather than building a site.
+ * A line that cannot resolve on its own declares what it needs (an alias, a patch to ignore), and
+ * a failed drush site:install used to end with "has been installed", over a half-installed site.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const FUNCTION = path.join(__dirname, '..', '..', '..', 'scripts', 'functions', 'fun-build-distribution.sh');
+const NODEJS = path.join(__dirname, '..', '..', '..', 'scripts', 'functions', 'fun-ddev-nodejs.sh');
+
+// Runs build_distribution with a fake ddev that records its arguments, one call per line.
+function build({ declare = '', installFails = false, composerFailsOnce = false, broken = false } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-build-'));
+  const log = path.join(dir, 'ddev.log');
+  fs.mkdirSync(path.join(dir, 'ws'));
+  const script = `
+WORKSPACE_SCRIPTS=/nowhere; WORKSPACE_ROOT=${dir}; doc_name=ws; PROJECT_NAME=p1; SKIP_DROP_DATABASE=yes; INSTALL=yes; REQUIRE=(_none_); ENABLE=(_none_)
+distribution_name=stub; distribution_webroot=docroot; distribution_project_template=drupal/stub; site_version=1.0.x-dev
+${declare}
+ddev() { printf '%s\\n' "$*" >> ${log}; if [ "${composerFailsOnce ? 'yes' : 'no'}" = yes ] && [ "$1 $2" = 'composer install' ] && [ ! -e ${dir}/failed-once ]; then touch ${dir}/failed-once; return 1; fi; if [ "$1 $2" = 'drush status' ]; then echo ${broken ? 'Failed' : 'Successful'}; fi; if [ "$1" = config ]; then mkdir -p .ddev; printf 'docroot: docroot\\ndatabase:\\n  version: "11.8"\\n' > .ddev/config.yaml; fi; return 0; }
+ddev_up() { :; }; set_default_settings() { :; }; add_drush() { :; }; drush_set_debug_on() { :; }; drush_cr() { :; }; add_users() { :; }
+source ${FUNCTION}; source ${NODEJS}
+source() { if [ "$1" = "\${WORKSPACE_SCRIPTS}/functions/fun-distribution-stub.sh" ]; then
+  install_stub_with_drush() { ${installFails ? 'return 1' : 'ddev drush site:install stub'}; }; enable_stub_extra_components() { :; }
+  else builtin source "$@"; fi; }
+build_distribution; echo "exit=$?"
+`;
+  const run = spawnSync('bash', ['-c', script], { cwd: dir, encoding: 'utf8' });
+  const calls = fs.existsSync(log) ? fs.readFileSync(log, 'utf8').trim().split('\n') : [];
+  return { calls, out: run.stdout, code: Number((run.stdout.match(/exit=(\d+)/) || [])[1]) };
+}
+
+const index = (calls, needle) => calls.findIndex((c) => c.includes(needle));
+
+test('a builder that declares nothing creates the project in one step, as before', () => {
+  const { calls, code } = build();
+  assert.strictEqual(code, 0);
+  const create = calls.find((c) => c.startsWith('composer create-project'));
+  assert.ok(create && !create.includes('--no-install'), create);
+  assert.ok(index(calls, 'composer require') < 0 && index(calls, 'composer install') < 0 && index(calls, 'patches-ignore') < 0);
+});
+
+test('every ddev config of a build pins Node.js 24, and the first one still gets its PHP version and --auto', () => {
+  const { calls, code } = build({ declare: 'site_php_version=8.5' });
+  assert.strictEqual(code, 0);
+  const configs = calls.filter((c) => c.startsWith('config '));
+  assert.strictEqual(configs.length, 2, configs.join('\n'));
+  for (const c of configs) assert.ok(c.includes('--nodejs-version=24'), c);
+  // #767 put ddev_telemetry_off inside this call's line continuation, so --php-version and --auto ran as a command.
+  assert.ok(configs[0].includes('--php-version=8.5') && configs[0].endsWith('--auto'), configs[0]);
+  assert.ok(!configs[0].includes('ddev_telemetry_off'), configs[0]);
+});
+
+test('a builder that declares site_nodejs_version gets that version instead', () => {
+  const { calls } = build({ declare: 'site_nodejs_version=22' });
+  const configs = calls.filter((c) => c.startsWith('config '));
+  for (const c of configs) assert.ok(c.includes('--nodejs-version=22') && !c.includes('--nodejs-version=24'), c);
+});
+
+test('declared requirements and patches to ignore are applied between create-project and the first install', () => {
+  const { calls, code } = build({
+    declare: `site_composer_requires=("drupal/stub_editor:1.2.3 as 1.2.x-dev"); site_patches_ignore=("drupal/pp https://x.test/a.patch" "drupal/qq https://x.test/b.patch")`,
+  });
+  assert.strictEqual(code, 0);
+  const create = index(calls, 'composer create-project');
+  assert.ok(calls[create].includes('--no-install') && calls[create].includes('--no-scripts'), calls[create]);
+  const order = ['composer create-project', 'composer require', 'composer config', 'composer install', 'composer run-script post-create-project-cmd', 'drush site:install']
+    .map((n) => index(calls, n));
+  assert.deepStrictEqual(order, [...order].sort((a, b) => a - b), `in order: ${calls.join(' | ')}`);
+  assert.ok(order.every((i) => i >= 0));
+  assert.match(calls[index(calls, 'composer require')], /^composer require drupal\/stub_editor:1\.2\.3 as 1\.2\.x-dev --no-update/);
+  // The ignore list is keyed on the patches package the distributions share, webship/patches.
+  const config = calls[index(calls, 'composer config')];
+  assert.strictEqual(config, 'composer config --json extra.patches-ignore {"webship/patches": {"drupal/pp": ["https://x.test/a.patch"], "drupal/qq": ["https://x.test/b.patch"]}}');
+});
+
+test('a failed drush site:install stops the build instead of reporting the site as installed', () => {
+  const { out, code, calls } = build({ installFails: true });
+  assert.strictEqual(code, 1);
+  assert.match(out, /install of ws p1 failed/);
+  assert.ok(!/has been installed/.test(out), out);
+  assert.ok(index(calls, 'drush') < 0, 'nothing runs after a failed install');
+});
+
+test('the first composer install is tried once more, because it can fail on a git cache hiccup and pass at once', () => {
+  const declare = 'site_patches_ignore=("drupal/pp https://x.test/a.patch")';
+  const { calls, code } = build({ declare, composerFailsOnce: true });
+  assert.strictEqual(code, 0);
+  assert.strictEqual(calls.filter((c) => c === 'composer install --no-interaction').length, 2);
+  assert.ok(index(calls, 'drush site:install') > 0, 'and the build carries on to the install');
+});
+
+test('drush is waited for, since DDEV rewrites its shared command directory whenever any project starts', () => {
+  const DRUSH = path.join(__dirname, '..', '..', '..', 'scripts', 'functions', 'fun-drush.sh');
+  const run = (failures) => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-drush-'));
+    const script = `
+n=0; mkdir -p ${dir}/ws/p/vendor/drush/drush; WORKSPACE_ROOT=${dir}; doc_name=ws; PROJECT_NAME=p
+ddev() { if [ "$1 $2" = 'drush --version' ]; then n=$((n+1)); [ $n -gt ${failures} ]; return; fi; }
+sleep() { :; }
+source ${DRUSH}; add_drush; echo "exit=$? tries=$n"
+`;
+    return spawnSync('bash', ['-c', script], { encoding: 'utf8' }).stdout;
+  };
+  assert.match(run(0), /exit=0 tries=1/);
+  assert.match(run(2), /exit=0 tries=3/, 'two misses, then it is there');
+  assert.match(run(99), /still not available[\s\S]*exit=1 tries=10/, 'but not for ever');
+});
+
+test('a site that installed but no longer bootstraps fails the build instead of being announced as installed', () => {
+  const ok = build();
+  assert.strictEqual(ok.code, 0);
+  const bad = build({ broken: true });
+  assert.strictEqual(bad.code, 1);
+  assert.match(bad.out, /does not bootstrap/);
+  assert.ok(!/has been installed/.test(bad.out), bad.out);
+});

package/core/workspace-app/tests/unit/build-order.test.js

@@ -0,0 +1,153 @@
+/**
+ * Settings → Command order: the order of a workspace's builders and tools.
+ *
+ * The part worth testing hardest is not the sorting — it is what gets WRITTEN. A page that recorded all
+ * forty rows every time you moved one would freeze the order of everything nobody has an opinion about,
+ * so a command added next month would land at the bottom instead of in its shipped place. The first
+ * attempt at that compared positions and got it exactly wrong: moving one builder from the bottom to
+ * the top shifts every other row down by one, so nothing sits where the defaults put it and all forty
+ * names look like decisions. One move wrote twenty-five lines. That is what `minimalOrder` is for, and
+ * what most of this file is about.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+// A file of its own per run, so these never touch the machine's own order.
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-build-order-'));
+process.env.BUILD_ORDER_FILE = path.join(TMP, 'build-order.yml');
+
+const order = require('../../build-order');
+
+const B = {
+  d11: 'cmd-drupal11-recommended-project.sh',
+  d12: 'cmd-drupal12-recommended-project.sh',
+  cms: 'cmd-drupalcms2-x-project.sh',
+  ws11x: 'cmd-webship11-0-x-project.sh',
+  cucumber: 'cmd-cucumber11-0-x-project.sh',
+  starter: 'cmd-website_starter-project.sh',
+  cmsOther: 'cmd-drupalcms2-x-starter-project.sh',
+  d9: 'cmd-drupal9-recommended-project.sh',
+  testing: 'cmd-automated-testing-webship11-0-x-project.sh',
+};
+const T = {
+  backup: 'cmd-tools-backup-dev.sh',
+  clone: 'cmd-tools-clone.sh',
+  upsun: 'cmd-tools-upsun.sh',
+};
+
+const write = (obj) => fs.writeFileSync(process.env.BUILD_ORDER_FILE, require('js-yaml').dump(obj));
+const clear = () => { try { fs.unlinkSync(process.env.BUILD_ORDER_FILE); } catch (_) { /* gone */ } };
+
+test('a builder is a cmd-*-project.sh; a tool is every other command', () => {
+  assert.ok(order.isBuilder(B.d12));
+  assert.ok(!order.isBuilder(T.backup), 'cmd-tools-backup-dev.sh is not a builder');
+  assert.ok(!order.isBuilder('cmd-tools-something-project.sh'), 'a tool that ends in -project.sh is still a tool');
+  assert.ok(order.isTool(T.clone));
+  assert.ok(!order.isTool(B.d11), 'the two kinds do not overlap');
+  // The remainder rule: a command shaped like nothing anticipated is still arrangeable.
+  assert.ok(order.isTool('cmd-all-front-end-build-themes.sh'));
+  assert.ok(!order.isCommand('AGENTS.md'));
+});
+
+test('the shipped order: the three bases, then the templates grouped by base', () => {
+  clear();
+  const all = [B.cmsOther, B.testing, B.starter, B.d9, B.cucumber, B.ws11x, B.cms, B.d12, B.d11];
+  assert.deepEqual(order.sortBuilders(all, 'dev'), [
+    B.d11, B.d12, B.cms, B.ws11x,        // the bases
+    B.cucumber,                           // and the lines beside Webship
+    B.starter,                            // the site templates on Website, the reference one first
+    B.cmsOther,                           // then anything else on Drupal CMS, together
+    B.testing, B.d9,                      // everything unnamed, alphabetical
+  ]);
+});
+
+test('Drupal CMS itself is a base, not one of its own templates', () => {
+  clear();
+  // `^cmd-drupalcms2-x-` would swallow cmd-drupalcms2-x-project.sh and put the base last; it is
+  // anchored exactly for that reason.
+  const got = order.sortBuilders([B.cmsOther, B.cms, B.d12], 'dev');
+  assert.deepEqual(got, [B.d12, B.cms, B.cmsOther]);
+});
+
+test("a workspace's own order comes before the global one, and both before the shipped default", () => {
+  write({ global: { builders: [B.d9] }, workspaces: { test: { builders: [B.testing] } } });
+  const all = [B.d11, B.d12, B.d9, B.testing];
+  assert.deepEqual(order.sortBuilders(all, 'test'), [B.testing, B.d9, B.d11, B.d12],
+    'test first, then global, then the shipped order');
+  assert.deepEqual(order.sortBuilders(all, 'dev'), [B.d9, B.d11, B.d12, B.testing],
+    'a workspace that says nothing gets the global order and nothing else');
+});
+
+test('builders and tools are separate lists, and saving one leaves the other alone', () => {
+  write({ workspaces: { dev: { builders: [B.d9], tools: [T.upsun] } } });
+  assert.deepEqual(order.sortTools([T.backup, T.clone, T.upsun], 'dev'), [T.upsun, T.backup, T.clone]);
+  // Save only the builders back.
+  const { raw } = order.rawOrder();
+  order.saveOrder(order.withScope(raw, 'dev', { builders: [B.d12] }));
+  const after = order.scopeOrder(order.loadOrder().raw, 'dev');
+  assert.deepEqual(after.builders, [B.d12]);
+  assert.deepEqual(after.tools, [T.upsun], 'the tools it was not given survive the save');
+});
+
+test('a mixed list is builders first, then tools', () => {
+  clear();
+  assert.deepEqual(order.sortCommands([T.backup, B.d12, T.clone, B.d11], 'dev'),
+    [B.d11, B.d12, T.backup, T.clone],
+    'alphabetical used to drop cmd-tools-backup-dev.sh between two builders');
+});
+
+test('minimalOrder writes ONE name for one move, not the whole list', () => {
+  clear();
+  const shipped = order.sortBuilders([B.d11, B.d12, B.cms, B.ws11x, B.d9], 'dev');
+  const moved = [B.d9, ...shipped.filter((f) => f !== B.d9)];
+  assert.deepEqual(order.minimalOrder(moved, 'dev'), [B.d9],
+    'moving one builder to the top shifts every other row, which is why comparing positions got this wrong');
+});
+
+test('minimalOrder writes nothing at all when nothing moved', () => {
+  clear();
+  const shipped = order.sortBuilders([B.d11, B.d12, B.cms, B.ws11x], 'dev');
+  assert.deepEqual(order.minimalOrder(shipped, 'dev'), [],
+    'a scope that names nothing is what lets a command added later arrive in its shipped place');
+});
+
+test('minimalOrder reproduces exactly what was posted, however it was arranged', () => {
+  clear();
+  const all = [B.d11, B.d12, B.cms, B.ws11x, B.d9, B.starter, B.cmsOther];
+  // Reversed is the worst case: nothing is where a default would put it.
+  const posted = [...all].reverse();
+  const kept = order.minimalOrder(posted, 'dev');
+  write({ workspaces: { dev: { builders: kept } } });
+  assert.deepEqual(order.sortBuilders(all, 'dev'), posted,
+    'what is written must reproduce what was on the screen');
+});
+
+test('what is written is filtered and deduplicated, whatever was posted', () => {
+  clear();
+  const { raw } = order.rawOrder();
+  order.saveOrder(order.withScope(raw, 'global', { builders: [B.d12, B.d12, 'cmd-tools-evil.sh', '../../etc/passwd'] }));
+  assert.deepEqual(order.scopeOrder(order.loadOrder().raw, 'global').builders, [B.d12],
+    'a repeat would give one copy a rank it can never reach; a non-builder is not a builder');
+});
+
+test('an empty scope is dropped from the file rather than left as an empty key', () => {
+  write({ global: { builders: [B.d12] }, workspaces: { dev: { builders: [B.d11] } } });
+  const { raw } = order.rawOrder();
+  order.saveOrder(order.withScope(raw, 'dev', { builders: [], tools: [] }));
+  const text = fs.readFileSync(process.env.BUILD_ORDER_FILE, 'utf8');
+  assert.ok(!/workspaces:/.test(text), 'the last workspace going empty takes the whole key with it');
+  assert.ok(/cmd-drupal12/.test(text), 'and the global order is untouched');
+});
+
+test('a missing or unreadable file is the shipped order, not an error', () => {
+  clear();
+  assert.deepEqual(order.sortBuilders([B.d12, B.d11], 'dev'), [B.d11, B.d12]);
+  fs.writeFileSync(process.env.BUILD_ORDER_FILE, ':\n  not: [valid\n');
+  assert.deepEqual(order.sortBuilders([B.d12, B.d11], 'dev'), [B.d11, B.d12],
+    'a broken order file must never cost you the Build form');
+  clear();
+});